13-Oct-2012 Security related parts and Vehicle Interfaces

Transcription

1 13-Oct-2012 Security related parts and Vehicle Interfaces Robert Beckmann President Beckmann Technologies & BlueLink Diagnostic Solutions Member NASTF VSC

2 First generation security systems Simple signal exchange with key Fixed Resistors Infrared RF Transponder Bi-Directional Release immobilizer in PCM START Key Inserted

3 Modern high security systems No limits on networked components Simply a mouse click to add security func. Security Codes Key Inserted PCM Steering Unlocked Security Codes Transmission BCM Security Codes Security Codes START

4 Modern security systems, GM Global A 10+ ECUs With Security Functions

5 Typical Security parts Locked to immo-codes Shifter Interlock Ignition Switch Instrumentation PIN CODES Steering Locks Engine Management

6 A-Typical Security parts Any mismatched parts? Security is creeping into many parts!

7 A-Typical Security parts Locked to particular vehicle VIN codes Sensing and Diagnostic Modules, BCMs Headlights really? Automatic Transmission with integrated TCU HVAC Telematics

8 How will this trend impact our businesses? Using parts from a donor vehicle will no longer be possible. Parts can lock themselves making them useless. Higher costs to industry due to lack of recycled or remanufactured options. Lower payments to insurers because of lower value on salvage.

9 Mercedes Security Parts Policy available with LSID: 24hr emergency key request MY and up only Electronic ignition lock Electronic workshop key (green/orange) Electronic infrared control unit Electronic selector lever module (Model 215, 220, 230 only) Electronic steering lock.

10 Mercedes Security Parts Not Available: Any vehicle key ML AAM/EAM (Body Control Modules) Gear control unit from NAG2 (722.9 only) Repair Kit for Gear control unit from NAG2 (722.9 only) But anyone can buy a complete transmission Airbag squib wire pigtail (Dealers don t understand) Often any part which requires a VIN. Dealer interpretation of policy.

11 BMW Security Parts Policy: 6/29/2009 Thank you for your recent NASTF information request. The BMW Group supports the rights of owners to have the choice to decide where and how to have their BMW Group vehicles repaired and serviced. However, due to our commitment to safeguard the security of our owners vehicles we are unable to provide the parts you have requested. Vehicle Security Team BMW of North America, LLC (on behalf of the BMW Group)

12 BMW Security Parts Policy: ISPs report hit or miss being denied parts sales, left up to the local dealer. No consistent or public policy.

13 BMW Security Parts Programming: Majority of parts can be programmed using BMWs online diagnostic application using a J2534 vehicle interface. No key or other security data available to aftermarket under any circumstances.

14 Porsche [VW] Security Parts Policy: Porsche does not restrict the sales of any security related components. Security related parts and keys can be programmed via a standard J2534 interface. Andrew Lennon Porsche Cars of North America 3/23/2012

15 Two Types of Security Systems How are they programmed? Early systems. Simple embedded PIN codes Modern systems. Complex RSA/DES encryption software

16 Early security systems Simple signal exchange with key Fixed Resistors Infrared RF Transponder Bi-Directional Release immobilizer in PCM

17 How are keys produced, and parts initialized?

18 Simple embedded PIN code Nissan used as an example Scan tool or PC/VCI Code (Hack or Legit via SDRM) Blank Key or Fob UNLOCK CODES PCM/BCM ANY BLANK KEY IS LEARNED

19 Simple embedded PIN code Summary PIN code usually stored digitally (hidden) in vehicle. Security easily compromised. Unaware of any systems that have not been. Legitimate businesses funding hackers.

20 Simple embedded PIN code Pros/Cons PROS: Simple to program Blank keys generally available Codes can be obtained via SDRM CONS: Easily compromised

21 High Security System Vehicle is manufactured with unique random encrypted key codes. Initially just 8 keys but then more than 32. Limits number of keys which could be issued. Private key data is archived and maintained by Manufacturer only. Secure Database

22 High Security System Not simple PIN codes. Much more difficult to compromise. Uses DES public/private key encryption software like banks.

23 High Security System Pros/Cons PROS: Vehicles are much more secure But are still getting stolen CONS: Limited number of keys Must rely solely on manufacturer for entire life of vehicle Manufacturer ALONE has control of this data. Great right, remember SAAB?

24 High Security System Making keys, option #1: Ton of cash Data Secret Location Frustrated customer, up to 84 hour delay worst case! Eternity

25 High Security System Making keys, option #2: Secure, traceable transaction, over internet Data SDRM Key programmed in car Happy Customer 24/7/365

26 Porsche [VW] Security Parts Programming Provides unrestricted traceable access to security programming of keys and emissions-related ECUs. Porsche AG

27 High Security System Option #1: Inconvenient Expensive for OEM, dealers, and consumers Impossible to maintain 24/7/365 service 24hr key delivery not possible in many cases Security flaws since key is plug and play Option #2: 24/7/365 service possible nearly everywhere Small investment for vehicle security professionals Significant cost savings to OEM, no FEDEX OE revenue source from SDRM transactions Traceability for law enforcement via SDRM

28 The importance of the SDRM Ever expanding security functions in a-typical parts. Must expand mission of NASTF Vehicle Security Committee to address theft related parts restrictions by some manufacturers such as Mercedes and BMW. Get your Locksmith ID to support the work on the SDRM! Don t start this process with a car waiting in the bay! It can take 2 4 weeks to process your application.

29 Questions about the SDRM Question: I need to get an insurance bond. Answer: You only need a bond if you wish to get an LSID for one of your employees. Your declarations page from your business insurance policy is adequate for you as the business owner to obtain an lsid.

30 Questions about the SDRM Question: If my state requires a locksmiths license for locksmiths I need to get one for my shop. Answer: If you are a Vehicle Service Professional you do not need a locksmith license. BUT if your state requires you to be certified or licensed as a VSP you do need this license.

31 Goal of the SDRM and the VSC VSC Mission: The NASTF Vehicle Security Committee will facilitate the identification, prioritization, and correction of gaps in accessibility to vehicle security system information, and tools, while maintaining the security and integrity of vehicle anti-theft systems My personal goals: Provide a legitimate and traceable means of delivering and tracking security information needed to perform security related programming of service parts to facilitate vehicle repair, and provide a 24/7/365 means of supplying security solutions to a stranded motorist.

32 The cat and mouse game Automotive manufacturers pressured to more positively secure vehicles by insurance industry and consumer demands. Hackers are funded by legitimate users of security circumvention technology since other affordable options are often unavailable. Adding security technology to a-typical parts causes long term problems which are not adequately being addressed by our industry today. Who wins and who loses, and what are the long term effects?

33 The cat and mouse game Lack of legitimate tools funds hackers Typical non-oe automotive security tools.

34 Solutions Provide legitimate OE supported means of programming keys and security parts using SDRM/LSID, J2534, and online connectivity. De-Fund a community of hackers by doing so. Manufacturers save money by NOT having to support a costly 24/7/365 infrastructure. Less tool obsolescence - Long term vehicle serviceability Lower long term legacy costs to a manufacturer

35 Conclusions Be on guard when dealing with security enabled parts. Encourage vehicle manufacturers to develop security key and parts programming software which embraces the SDRM and standardized vehicle interfaces. Support NASTF! We are constantly looking for motivated individuals willing to help. Questions?

36 Thank you for attending this discussion!